DPA case D130.2269 – Dismissed (Austria, 2026)

The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace platform within the Union that connects costumers with independent vendors mostly located in Asia. The use of the controller’s platform requires potential costumers to create an account with the platform. When a customer orders a product via the platform, the controller establishes the contact between the costumer and the vendor. The parties of the purchase contract, however, are the customer and the vendor, not the controller. The processing of personal data in the context of providing the controller’s platform takes place within the Union and in the United Kingdom. In case of an order, the personal data is transferred to the vendors registered on the platform who offer the requested product. A customer (data subject) created an account with the controller’s platform in 2024. He logged into his account on the platform another time in 2024 and once in 2026, shortly after the procedure before the DPA was concluded. During his log-in in 2026, the data subject placed an order via the controller’s platform. In the course of the order, the data subject’s personal data was transferred to the People’s Republic of China and to two companies within the US. The European Commission has issued an adequacy decision pursuant to Article 45 GDPR concerning data transfers to the US (so-called “Data Privacy Framework”). Both US companies are featured on the “Data Privacy Framework List”. There is no adequacy decision concerning data transfers to the People’s Republic of China. The Irish DPA has declared itself not competent for the procedure at hand. The DPA held that the complaint at hand cannot be considered an abusive exercise of rights and was legally admissible. The question arose because the DPA considered the complaint as part of a campaign against processing of transfers of personal data to the Peop